A Service Level Agreement (SLA) is a formal document between a service provider and a client that defines the expected level of service, including what resources will be provided and the agreed-upon time frames. It typically includes metrics to evaluate performance, uptime guarantees, and response times.
* MOU (Memorandum of Understanding) and MOA (Memorandum of Agreement) are less formal and may not specify the exact level of service.
* BPA (Business Partners Agreement) focuses more on the long-term relationship between partners.

The administrator is using a Data Loss Prevention (DLP) tool, which is designed to identify, monitor, and protect sensitive data. By fingerprinting specific files, DLP ensures that these files cannot be emailed or sent outside the organization without triggering an alert or blocking the action. This is a key feature of DLP systems, which prevent data exfiltration and ensure data security compliance.
* SNMP traps are used for network management and monitoring, not data protection.
* SCAP (Security Content Automation Protocol) is a set of standards for automating vulnerability management and policy compliance, unrelated to file monitoring.
* IPS (Intrusion Prevention System) blocks network-based attacks but does not handle file fingerprinting.

The correct answer is D. Peer review and approval.
Peer review and approval help prevent a single developer or insider from inserting malicious code without oversight. This practice supports separation of duties, accountability, secure software development, and change control. Requiring another qualified person to review and approve code changes increases the chance that suspicious, unauthorized, or malicious code will be identified before it enters production.
Why the other options are incorrect:
A). Code scanning for vulnerabilities
Code scanning can identify known vulnerabilities, insecure coding patterns, and some misconfigurations.
However, malicious code intentionally written to appear legitimate may not always be detected by automated scanning.
B). Open-source component usage
Using open-source components does not prevent insider abuse. In fact, open-source dependencies may introduce additional supply chain risk if not properly reviewed.
C). Quality assurance testing
Quality assurance testing verifies whether software works as intended, but it may not detect intentionally malicious logic hidden in the code.
Therefore, peer review and approval is the best practice to prevent an insider from introducing malicious code into the development process.